I would suggest two new structures to deal with ingress/egress packet sampling and to maintain compatibility with the existing extended_vlantunnel structure and fit with the spirit of the sFlow Tunnel Structures extension (
http://sflow.org/sflow_tunnels.txt):
/* opaque = flow_data; enterprise = 0; format = 1034 */
extended_vlanin {
unsigned int stack<>; /* List of ingress 802.1Q TPID/TCI layers. Each
TPID,TCI pair is represented as a single 32 bit
integer. Layers listed from outermost to
innermost. */
}
/* opaque = flow_data; enterprise = 0; format = 1035 */
extended_vlanout {
unsigned int stack<>; /* List of egress 802.1Q TPID/TCI layers. Each
TPID,TCI pair is represented as a single 32 bit
integer. Layers listed from outermost to
innermost. */
}
In the case of the ingress sampled packet in Open vSwitch, the ingress VLAN stack is present in the packet header so only the extended_vlanout structure would be added to describe the vlan stack created by any push/pop operations performed by the switch. Any labels stripped by the network adapter could be reported in the extended_vlantunnel.
In the case of egress packet sampling, the extended_vlanin structure would be used to describe the stack on ingress. The extended_vlanout would only be included if the sampled packet header didn't already include the information.
Does this make sense? Do you think it covers all the use cases?